Release notes for pymetadata 0.8.2

Security

• certifi>=2026.10.19 is a runtime dependency (#106). certifi 2026.10.19 removes the emSign root CA, whose intermediates have compromised keys (GHSA-6q48-6c7w-9gw2). pymetadata reaches the web services through requests, which verifies the certificates with the CA store of certifi, so the floor applies although certifi is not imported.
• The lock of the development environment, uv.lock, has certifi 2026.10.19 and virtualenv 21.14.12, which seeds pip 26.2.2 (vendoring certifi 2026.10.19) into the environments of tox (#106). uv is pinned nowhere: continuous integration installs the latest uv, 0.13.4 or newer, which fixes its bundled CA store (GHSA-hq85-5cpj-mr62); a local uv older than 0.13.4 should be updated.

Your pymetadata team